Founder, Trusted Path · London
I spent 20 years finding security flaws after the build. Now I help teams catch them at design.
I'm Aman Hardikar, a security architect and the founder of
Trusted Path.
At Santander, Mimecast, IBM and NCC Group I kept seeing the same thing: the costly problems
were decided in a planning meeting months before anyone tested them. Trusted Path moves
security, privacy and resilience review into planning and design, while a fix is still cheap.
Taking pilot teams now
ISSAP · CISSP · CISA
SABSA SCF
AWS Security · KCSA
CREST CRPT
Security work at
Santander UK
Mimecast
IBM Security
NCC Group
Argus Media
Metapack
20+
years across architecture, pen testing, forensics and audit
26
industry certifications, including ISSAP, CISSP and CISA
2×
SANS pentest poster, built from my practice lab mind map
12 yrs
as a GIAC Gold Advisor for SANS research papers
01 · Why Trusted Path
Late reviews are where the money goes
For most of my career I was the person called in at the end. A pen test the week before
launch. An audit finding that sends a team back to rework an auth flow they shipped six months
earlier. A DPIA written after the data was already moving.
The findings were usually right. The timing was the problem. By the time security looked at
the work, the cheap options had gone, and the team paid for it in rework and delayed releases.
I started Trusted Path in 2025 to put that review at the start, when a team is still deciding
what to build. It sits inside the planning and design work engineers already do. The evidence
auditors and regulators ask for builds up along the way, so nobody has to reconstruct it in a
panic before an assessment.
"Every engineering team sits somewhere on the curve."
The TRUST framework · Trusted Path
02 · What gets checked
Handled once, early, by the team that ships
01
Security
Threat modelling and secure design review during planning. Controls mapped to OWASP SAMM and NIST SSDF, so you can show your working.
02
Privacy
Data flows captured against user stories. DPIA triggers raised in the backlog where engineers will see them, with lineage records kept as you go.
03
Resilience
Supplier and dependency risk mapped up front. Scenario testing aligned to DORA, and recovery posture reported as a live number.
Maps to
ISO 27001
NIST SSDF
OWASP SAMM
DORA
NIS2
SOC 2
ISO 42001
03 · The TRUST model
Where does your team sit today?
Level 1TTribal
Level 2RRepeatable
Level 3UUniform
Level 4SSteered
Level 5TTuned
FirefightingFlow
The pilot maps where one project sits today, where it needs to be for the regulations
you face, and the smallest move that gets it there. Read about the framework ↗
Now booking
Run a 30-day pilot on one project.
I'm taking a small number of engineering teams through a fixed-scope pilot, and I'm involved
in each one myself. You pick a live delivery project. After 30 days you have a maturity baseline,
design-stage findings, a prioritised roadmap and a report you can take to the board.
Scope1 delivery project
Length30 days
SectorsFinancial services, healthcare, critical infrastructure
Org size50 to 1,000 people
Team10+ engineers
FounderInvolved throughout
04 · Experience
Track record
2006 to present
Founder
Jan 2025 to Present
London, UK
Founder
Secur3 Ltd
Jul 2018 to Nov 2024
London, UK
GIAC Gold Advisor
GIAC / SANS Institute
Apr 2009 to Dec 2021
Remote
Cloud Security Architect
Santander UK
Dec 2021 to May 2023
Milton Keynes, UK
Lead Security Architect / Engineer
Argus Media
Sep 2018 to Dec 2021
London, UK
Senior Security Architect / Engineer
Metapack
Apr 2018 to Sep 2018
London, UK
Senior Security Architect
Mimecast
Sep 2015 to Apr 2018
London, UK
Security Consultant
IBM Security [UKI]
Feb 2014 to Aug 2015
London, UK
Security Consultant
NCC Group (NGS Secure)
Mar 2011 to Feb 2014
Leatherhead, UK
Senior Consultant
Emirates Integrated Telecom (Du)
Oct 2009 to Jul 2010
Dubai, UAE
Security Consultant
SecureSynergy
Sep 2006 to Jan 2009
Bangalore, India
05 · Practice areas
What I still do hands-on
01Cloud security architecture and engineering
02Application and technology architecture
03DevSecOps and CI/CD pipelines
04Containers, Docker and microservices
05Security automation and analysis
06Threat modelling and risk management
07Development in C++/Qt5, Node.js and AWS Lambda
08Security assessments, malware analysis and forensics
09Compliance: ISO 27001, PCI DSS, NCSC, CSA, GDPR
06 · Open work
Things I've given back
free to use
SANS
SANS pentest poster
2015 and 2016 editions
SANS picked my Hacking Practice Lab mind map for its pentest poster two years running. It lists safe, legal places to practise offensive security. See the mind maps →
SANS Reading Room
Malware 101: Viruses
April 2008
A taxonomy of malware classes and the incident handling that suits each one, because a worm and a macro virus need different responses. Read the papers →
Tooling
Open-source security tools
SSLAuditor, sqlmapGUI, Concute and more
Freeware I wrote for my own pen test engagements and then released, from SSL auditing to merging reports across scanners. Browse software →
Reference
22 security mind maps
AWS, PKI, ISO 27001, SABSA, forensics
Study maps I built while preparing for exams and engagements, shared for anyone doing the same. Open the library →
2026
Quantic
Executive MBA
2025
Oxford Saïd Business School
Executive Management Program
2018
Cylon HutZero4
Startup Accelerator Program
2015
SABSA Foundations (F1, F2)
Enterprise Security Architecture
2013
IASA UK Architecture Summit
Enterprise, business and IT architecture
2011
SANS EUDFIR 2011
European Digital Forensics & Incident Response Summit
2010
SANS Europe 2010
SEC560: Network Penetration Testing
2007
SANS Onsite India
SEC504: Hacker Techniques & Incident Handling
08 · FAQ
Questions people ask me
Who is Aman Hardikar?
I'm a London-based security architect and the founder of Trusted Path. I've worked in security for more than 20 years, at Santander UK, Argus Media, Mimecast, IBM Security and NCC Group among others, and I hold 26 certifications including ISSAP, CISSP and CISA.
What is Trusted Path?
A software assurance platform for engineering teams in regulated sectors. It brings security, privacy and resilience checks into planning and design, so problems turn up before code is written and not at audit. More at trustedpath.biz.
Who is it for?
Financial services, healthcare and critical infrastructure organisations with roughly 50 to 1,000 people and engineering teams of 10 or more. The people I usually talk to are CTOs, VPs and Heads of Engineering.
How does the 30-day pilot work?
It's fixed scope. One delivery project, 30 days, and I'm involved throughout. You come out with a maturity baseline, design-stage findings, a prioritised roadmap and a board-ready report. Book a pilot here.
Which frameworks and regulations does it map to?
ISO 27001, NIST SSDF, OWASP SAMM, DORA, NIS2, SOC 2 and ISO 42001.
What is the TRUST maturity model?
Trusted Path's five-level model: Tribal, Repeatable, Uniform, Steered and Tuned. It shows where a team is today, where it needs to be for the regulations it faces, and the smallest next step to get there.
Are the mind maps and tools still free?
Had an audit finding cost your team a quarter? Let's look at the next project before it starts.
